Inspector General's Review of OAS Programs Q1/2018

1. Office of the Inspector General Presentation to the Working Group on the Review of OAS Programs of the OIG’s major plans and activities as of Q1/2018 GSOAS/OIG, April 5, 2018

2. Agenda • Status of the plan to enhance monitoring of OIG recommendations • Other OIG activities and proposals to strengthen its operation

3. Status of the plan to enhance OIG’s recommendations monitoring • LIST OF ACRONYMS USED: IIA = The Institute of Internal Auditors; SMART = Specific, Measurable, Achievable, Responsible person, Time; CAAP=Committee on Administrative and Budgetary Affairs

4. Criteria for audit observation’s ratings

5. IIA’s recommendations for small internal audit activities - * In Compliance with Standard 2500 – Monitoring Progress • Existing open recommendations: • Were re-assessed. Those rated Medium or Low Priority were handed over to management. • New recommendations: • OIG commits to follow - up only on those rated High or Medium Priority *The Institute of Internal Auditors (IIA) defines a small audit activity as one which typically will have one or more of these characteristics: One to five auditors; Productive internal audit hours below 7,500 a year; Limited level of co-sourcing or out-sourcing.

6. Re-assessment of existing open recommendations and monitoring within the General Secretariat • The reassessment was done. Low and medium risk/priority audit recommendations were referred to management for further self-assessment and consideration. Those recommendations may eventually be considered in subsequent audits • 14 high risk/priority recommendations identified and also communicated to management. Each of those recommendations have an auditor assigned for follow-up. • The auditors have been assigned 10 working days per quarter of block time for monitoring. During the block time period, the monitoring of recommendations will be their first priority. • Current block time period started on March 21 and ended yesterday, April 4th.

7. List of high risk/priority recommendations after re-assessment

8. Agenda • Status of the plan to enhance monitoring of OIG recommendations • Other OIG activities and proposals to strengthen its operation

9. OIG matters completed per year 23 22 11 11

10. OIG – Operational road map 2017 - 2019 2017 2018 2019 Long term ambition Optimized processes led by a learning organization. - Define and establish performance indicators • - Promote an AC • - OIG’s Online Portal • - Update Executive Order 95-05 - Establish a QAIP - Explore Data Analytics Continuous improvement - Implement Quality Assessment recommendations - Develop Standard Audit Programs - Automated follow up (Team Central) - Conclude 2017 audits - New follow up approach - Update risk-based plan - Audit Charter - Quality Assessment - Update manual Certified audit activity that provides value added recommendations, monitors agreed actions and ultimately helps OAS achieve its objectives through world-class audit services. - Self-assessment - Foster management’s engagement with audit recommendations - Complete or substantially complete the audit plan Audit activities Diligent and expeditious investigations that strengthen OAS transparency & accountability. Investigation activities - Update manual - Review Harassment Policy - Conduct a Peer Review - Reduce backlog - CPE fulfillment - IDP monitoring - Increase CIA/CFE team members - CPE fulfillment - Conclude recruitment process - Introduce IDPs - CPE fulfillment - Preparation for Quality Assessment - Initiate recruitment process A team that attracts and develops talent. People • LIST OF ACRONYMS USED: OIG= Office of the Inspector General, AC= Audit Committee, QAIP=Quality Assurance and Improvement Program, CPE=Continuing Professional Education, IDP=Individual Development Plan, CIA = Certified Internal Auditor, CFE= Certified Fraud Examiner

11. IIA Considerations for an Audit Committee 1 The IIA defines Board as “The highest level governing body charged with the responsibility to direct and/or oversee the organization’s activities and hold senior management accountable. If a board does not exist, the word “Board” refers to a group or person charged with governance of the organization. Furthermore, “Board” in the Standards may refer to a committee or another body to which the governing body has delegated certain functions (e.g. an audit committee).”

12. Considerations for an Audit Committee • Typical functions of an Audit Committee • Approves the IA charter. • Approves the risk-based internal audit plan. • Approves the IA budget and resource plan. • Follow-ups on IA activities and recommendations. • Approves decisions regarding the appointment and removal of the CAE. • Approves the remuneration of the CAE. • Makes appropriate inquiries of management and the CAE to determine whether there are inappropriate scope or resource limitations. • Composition of an Audit Committee: Include members who are not part of management and may include the top management (e.g. CEO and CFO), usually is lead by a Chairman of the Audit Committee who is not part of management and has audit experience. • If the OAS makes a decision of establishing an Audit Committee, it can be doing by stablishing a new body or by extending the role of the Board of External Auditors. In any case, it would require a review of the General Standards to Govern the Operations of the General Secretariat. General Standards are finally approved by the General Assembly.

13. OIG Organization OIG Organization as of Dec. 31, 2017 OIG Proposed Future Organization • P02 Audit – CPR contract was concluded on February 28, 2018 and not longer extended. • In 2017 the GS/OAS tracked and managed over 500 donor agreements with a total expenditure of USD 56.6 million. • As part of donor-imposed conditions 9 external financial audits were conducted in 2017. • The OIG audited 2 projects in 2017 (Cultural Heritage Phase II Project and Judicial Facilitators Program).

14. Proposed OIG’s budget 2019 - This Budget 2019 proposal considers the proposed changes to the OIG’s organizational structure (including the strengthening of the oversight of the Specific Funds), onsite audit & investigations at member states Offices/Missions and third party specialized support in topics such as Information Technology, Forensic Analysis, Security, etc. - This proposal is still below the funds that the OIG was allowed in 2013, both, in absolute terms and in relative terms.

16. Backup Slides

17. Introduction of agreed SMART actions SMART acronyms stands for: Specific, Measurable, Achievable, Responsible person, Time. • Before, the OIG recommendations lacked an agreed action plan with due date, specific actions and responsible person. Accordingly, was not always clear what management had agreed to do to address the OIG recommendations and due date. • Since Q4/2017 management is required to provide SMART action plans to the audit recommendations. • The auditors are collecting smart action plans for the existing high risk/priority rated recommendations. • We will be now in position to start measuring if agreed management actions are overdue or not.